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this £ssible° tiT f0r ,hal k J? d in,roduclion - Thanks to you and to Fordham for making 
P° sslble - This has become one of the most important gatherings of people who care about 

andThaSksTo^ ^ a " d abadamia < bat < bare * 


now t0 S , tart tl ]° U9h , by saying— I'm glad you mentioned it— my heart is still heavy from 
not!ng^that IU ® 0n SU " day and 1 wanted -' could "’t here in this great city without 


Echomg in my head are words from Bill Bratton at Detective Ramos’ funeral where he urged 
that we a I find ways to see each other better. That law enforcement work to see the 9 

' '*!? fJ hat W ® pr ° teCt better and that the communities work to see law enforcement 

T:LrToTJ re J^' Very WiSe W ? rdS - And especially 9' ven the events of the last day or 
so where two more officers were wounded, I hope that part of that seeing involves an 

appreciation for just what policing involves. How hard it is. How dangerous it is But I think 

hnn. S tn n h ,mp0rtant f onversation 9°' n 9 on in this country right now about race and Sg and 
I hope to have more to say about that in the next couple of weeks. P 9 

But I’m here today to talk about cyber. Before I get to that, let me also say that mv heart ooes 
out to the peop e of France and Paris this morning. We’re thinking of them We have the FBI a 

rel tr hip wi,b . our i" the French law enforcement a^d wuntert^odsm 

ii. c , m r eS - W * are work,n 9 with them. We will do everything we can to help them bring to 

in Paris " a * EX of 

Let me turn now to the reason that I’m here, which is to talk to you about how we at the FBI are 

recent rase°s ’ ln y o b aTlicui : aM y w a nd t T® ° yber ,hrea1 ' 1 wan ’ ,0 talk a liltle bit abou > som « of #>e 
SS , p h a l : want ,0 Slve y° u some new information about the investigation that 
we re doing into the Sony hack perpetrated by the North Koreans. y 

Let me start by telling you what you know, which is that everything has changed in wavs that are 
so fundamental tha ,t's difficult to describe what it means wlin we say the vSt isThanoinl 

^nf Z Cy ? r , N T ' f ! nd ! hat in a " ,hi "9 s < b ere's a lot Of nodding and! wol Ss 
r) __ a ri °' understanding behind the nodding at times. And so I always look for ways to 

describe just how fundamental the transformation we’re standing in the middle of is. 
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thA n ° d . oubt that everything has changed because we’ve connected our entire lives to 

rocnJrfo ^'/bf IS W * hy ’ because al1 of llfe ls there, that all of the parts of life that the FBI is 
responsible for trying to protect— whether it criminal, counterintelligence, counterterrorism 

protecting children, fighting fraud— it all happens there because that’s where life is. 

What I want to tell you this morning, now afternoon, is how we’re thinking about the threat what 
our s ra egy is for the threat, addressing the threat, and why our partners in the private sector 
matter so much to us being successful in fighting the threats we’re responsible for. 

Let me start with the threat. I actually try to describe to people in very simple ways what we’re 

m Sdt°„ U nL day STT 1 ?? see Cyber as a ,hin °’ 1 see * »»»*< a vector Because 
my children play on the Internet. Because that’s where I bank. Because that’s where my health 

care is. Because that’s-l don’t have a social life, but if I had one, that’s where I’m su^it would 

onrtTS-! W £ ere 0Ur , n x atl0n ’f cr,t,cal infrastructur e is, that’s where our government’s secrets are 
^ n ® because life is there, that’s where bad people come who want to hurt children, who 
want to steal money, who want to take identities, who want to steal secrets, who want to 
damage dams and critical infrastructure in the United States. It’s the way they come at us 

because that’s where life is. y 

' bad l e " back !° wb3t ' be ' ieve was the great vector change that gave birth to the FBI. And this 
popped in my head when I was visiting the field office that we have in Indianapolis A local 
sheriff gave me a round that had been fired from John Dillinger’s Thompson submachine gun It 
occurred to me that the great vector change of the 1920’s into the 193(Ts was the confluence of 
the automobile and asphalt. It gave birth to an entirely new way of doing bad things. 

Hn^nhMi ,y D ri hi COuld ?] ove at bre3thtakin 9 speeds, right? Forty miles an hour. Fifty 
downhill. Right? They could go from Ohio to Indiana to Illinois in the same day and do bank 

!. n ea £ h °!* b ° se locatlons - They were blowing away traditional notions of county line 
and state line. Right? It was straining the framework that law enforcement used and so a* 

n u 6ded an A d ? ere was-l ' m the seventh director— there was the first director 
of the FBI J. Edgar Hoover. And a national force was born to respond to that entirely new way 
of crimes being committed. A new vector that required a new approach. 

S J^ a l ti i m ?u a mil,i0l l Di [ linger or Bonnie and C| y de could not do a thousand robberies in 
trlriaw rt ! ^5® same da V from their pajamas from Belarus. That’s the challenge we face 

tional notfons of space and time and venue and border and my jurisdiction and 

hN^at 1 flft nnn , b own away by a threat that moves not at 40 miles an hour or 50 downhill 
but at 1 86,000 miles per second. The speed of light. 

ITSTk n0ti T’ framewo J s - are destroyed by that kind of threat. That requires every part of 
the FBI, those who are spending their days protecting kids, fighting fraud, fighting spies fiahtina 

5,°^.; protecting intellectual property, all of those things; it requires those people to be 
2S y th' era e ' 1 req ^' res me t0 have the r '9 ht kind of people, the right kind of equipment and 
D?iHnger h em 3 ^ h3t W ‘ th 3 V6Ct ° r Change that is mind b °99 ,in 9 compared to the 







So what to do? Let me turn to our strategy. The first thing to do though is adopt an attitude of 
humility. I think we stand in the single greatest transformation in human history and anybody 
who stands here and says, “I know what five years from now looks like, I know what 10 years 
from now looks like, and therefore the FBI should be deployed and equipped in the following 
way,” is arrogant and, in my view, foolish. 

I have to approach this with a sense that we have never seen this before. So I have to be 
humble enough to say, I’ll take things that seem reasonable, I’ll get feedback, and I’ll iterate. So 
we approach it, I hope, with humility. 

And then we devise a five-point strategy. We’re going to try to focus ourselves, we’re going to 
try to shrink the world, we’re going to try to impose real costs on bad actors, we’re going to try to 
improve our relationships with state local law enforcement and most importantly of all, we’re 

going to try to improve our relationship, our battle rhythm, our working relationship with private 
sector partners. 

Let me say a word about what I mean by each of those. 

Focus. Because this affects everything that we might be inclined to deal with, we can’t do it all. 
And so what we’re trying to do in the FBI is figure out so where should our resources be 
deployed. And we think it makes sense to go against the biggest. The worst. The baddest. And 
think about what to go after given what’s unique about the FBI. We have international reach and 
we have significant resources. So given that, what should we focus on? And there’s a lot to 
choose from as you know. 

I have been teased repeatedly, but I’m not giving up describing the threat we face as an evil 
layer cake with nation states at the top... terrorists, organized criminal actors, sophisticated 
worldwide botherders and botnets, hacktivists, weirdoes, bullies, pedophiles, creeps... all kinds 
of people at the lower levels of the layer cake. 

We re going to try to focus on the top layers of that cake and focus ourselves on the nation state 
actors and the biggest, the most extensive, the most dangerous criminal syndicates and 
international operations. Where can we make the biggest impact for the investment of 
resources? 

We’re also, as we focus those resources, going to try to deploy them in a different way. As I 
said, this vector change blows away traditional notions of, well, this is my area of responsibility, 
this is your area of responsibility. This is my judicial district, that’s your judicial district. Blown 
away by a threat that’s moving as a photon. 

And so we’re going to assign this work not based on some notion of physical fixed jurisdiction or 
venue. We re going to assign it where the talent is. So what we’re doing is looking across the 
FBI and saying, “Where is the talent to deal with this particular threat?” And we will assign that 
threat to that field office. It could be at one corner of the country or the other corner of the 
country. It s where the talent is. And then we’ll allow up to four other offices to support that 
effort, to help the primary assigned office. We call this the cyber threat team model. Seems to 
make good sense to me. I don’t know. We’ve never done it before. We’re trying it and we’re 

getting feedback from people to see whether it works and whether we need to iterate and 
change in some fashion. 
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Second, shrink the world. What do I mean by that? The bad guys have shrunk the world on us. 
They re sitting in their pajamas half way around the world. They’re in a military uniform halfway 

around the world moving at the speed of light. Blowing away the traditional notions. Shrinking 
the globe to the point of the pin. We have to do the same. 


So we re trying to do a couple different things to respond to that. We’re going to forward-deploy 
more and more cyber special agents of the FBI and intelligence analysts of the FBI in our 
foreign partners’ offices around the world to make sure that our battle rhythm tries to keep up 

with the threat that’s moving that fast. To forward deploy so we have no gap between when the 
threat is seen and when someone acts on it. 

And the second thing we’re going to do is, within the government, try to continue to improve at 
getting our act together at dividing up our resources between organizations in the government. 

As I’ve said before, when I left government in 2005, 1 described our response to the cyber threat 
as a bit like 4-year-old soccer. I have five children as I think I said, and I watched a lot of 4-vear- 

0 d ®° cc ® r and rt ' s clumps of children chasing the ball. Because the ball is the cool thing so you 
want to be near the ball at all times so in big clumps they chase the ball. Cyber was very cool. 

All of us in government knew we had to do something about cyber, so there was a big clump of 
us running around chasing it. a K 

Now that I ve come back— I’ve been back a year and four months now. I saw when I came back 
we ve made significant progress. We’re probably high school, college-level soccer. We spread 
out. We know we have to pass. We know it’s important to know where you are on the field 
Everybody shouldn’t be following the ball. But we’re facing a World Cup-level adversary We 
have to get better at feeding each other the ball when we need it and doing it at machine speed. 

We have built as a government something called the National Cyber Joint Investigative Task 
Force, NCIJTF, where 19 federal agencies sit together and divide up the work. See the threat 
see the challenge, divide it up and share information. That’s great. That’s one significant down 
payment on moving toward World Cup-level soccer, but we have more to do. 

1 said we need to impose costs. What do I mean by that? I worry sometimes that whether the 

actor is a nation state or a criminal or a creep down the block, there’s a sense that it’s a freebie. 
That if I m at a keyboard somehow it’s free that I can break in and steal the lifeblood of an 
American business or steal the identity of an American citizen when it is in reality no different 
than kicking in your front door and walking out with your television, right? Or draoaina 
something you love dearly out of your life. aa a 

We have to treat it that way. We have to impose real costs on people who think they’re 
a one. . .think they re far enough away that it’s a freebie. And the first way we need to do that is 

??/ 0 .. aS possit ? le - la y hands on P e °P |e and <ock them up. Often when I say that people say ’ 
Well, these people are far away and they’re in foreign countries.” I’m not saying it’s easy but 
we are dogged people. Never say never. 

As the world shrinks and people travel, we have more and more opportunities to lay hands on 
people who think they perpetrated a freebie in an effort to make it a real cost. So we’re going to 
try to lay hands on people or get our partners to lay hands on people as often as possible 
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The other thing we re going to do is when we can’t lay hands on people, as often as possible 
we re going to call out the conduct. And as often as we possibly can we’re going to say here’s 
what happened and who did it. It’s why I thought it was so important that the indictment was 

^ore^or°a naked th^^th °! , Pe f n A nsylvania indictin 9 the five People’s Liberation Army 
actors for a naked theft of the lifeblood of American companies. I thought it was very verv 

important to have that be a public indictment and explain the conduct. 

For the same reason I thought it was very, very important that we as a government we as an 

Srn ' h W ! kn w W W ?° h3Cked S ° ny ‘ was the North Korea "s wh0 hacked Sony. And call out 
a !. c ° nduct and ex P^ in It. That is why we have, as much as we can, tried to offer our 
attribution and the whys behind our attribution. 

L he ,^ StrUCtlV f natU u 6 0f that attack proves that ever y°ne has to take cyber security seriously It 
North Kor P P r.?h a, : yb0dy in thiS r ° 0m ‘ The TreaSUry De P a rtment’s recent sancton^S*' 
even^Alriaht? Thatch 6 an in ?. portant s,gnal of how seriously the government takes these 

hafm Ami? ht ' Th i h A Wl be consequen ces for those who use malicious cyber activity to 
harm Americans or harm American businesses. y y 

£ ayou ♦♦"T’ * We K f l tb ® FBI and the entir e intelligence community have previously attributed 

North Korea and we continue to believe that is the case. There is not much in 

dnp^hl h fl h ? n' gh confldence about. I have very high confidence about this attribution as 
does the entire intelligence community. 

KorS w.rho n0 . W i ha ! ? ^ hy d ° ' have SUCh high co " fid ®nce in this attribution to North 
Korea? Wen, here s the tricky part. I want to show you as much as I can the American oeoole 

we 0 sif a e nrt wh a ? d ' Want p Sh ° W the bad 9UyS aS ,ittle as possible about how. Okay? Fk>w 
and our sources ^ US ® * Wi " happen again and we have t0 P reserve our methods 

t T h p e H e a r,l C t ° UPle °/ Way ! we v ® a,reacj y said > r 'g ht? Y °u know that the technical analysis of 
tbe da [f delet, on malware from the attack shows clear links to other malware that we know the 

cyber SaThE Th ? ,00ls in ,he ** -**» bw strikes M.aStoa 

bfnksandmedto^lte“s d in MarCh ° f ' asl year a9ainst South Korean 

We ve done a— I have as you may know from watching “Silence of the Lambs " people who sit 

0 ii? h Ua H n iC ° -; ery ? ark Jobs ' T heir job is trying to understand the minds of bad actors That’s 

: W6 t th ,? m t0 W ° rk Studying the statements ' writings, the 

rnmnlli iH P 1 P wbo ° laim to be the s °- called Guardians of Peace in this attack. We 

SsTs the same S ’’ ^ kn ° W the ^ K ° reanS have d ° ne and they say ’ “ Easy for 

^ b ™ ugbt , in a red team fr °m all across the intelligence community and said “Let’s hack at 
|S - at else could be explaining this? What other explanations might there be? What miqht 

we be missing? What competing hypothesis might there be? Evaluate possible alternatives 9 
What might we be missing?” And we end up in the same place 
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^L k f?Z ? ecause IVe re f d jt in th e newspaper and I’ve seen it on the news, that some 
serious fdks have suggested that we have it wrong. I would suggest— I’m not sugqestina I’m 

sayrng. They don't have the facts that I have, don't see what I £e. but there areTSe this 

that I have urged the intelligence community to declassify that I want to tell you right now. 

The Guardians of Peace would send e-mails threatening Sony employees and would post 
online various statements explaining their work. In nearly every case they used proxy servers to 

sta?em S ente 6 V W6re COmi " 9 ^ Sending th ° Se e_mai ' S and in p ° stin 9 tbose 

But several times they got sloppy. Several times, either because they forgot or because they 

th^iP ^ Pr° blem - they connected directly and we could see them. And we could see^hat 
the IP addresses that were being used to post and to send the e-mails were coming IPs that 
were exclusively used by the North Koreans. y 

lZZLTJ ak l by that haven>t told you about before that was a very clear indication 
h*fnro aS do ng , tbls - They would shut it off very quickly once they realized the mistake, but not 
before we saw them and knew where it was coming from. 

As I said, we have a range of other sources and methods that I'm going to continue to protect 
because we think they’re critical to our ability— the entire intelligence community’s ability— to 

t0 . understand this attack be tter. We have brought them all to bear in this 
" Where started — not wit h just high confidence, but very high confidence 

that the North Koreans perpetrated this attack. 

We’re still looking to identify the vector. How did they get into Sony? We see so far spear 
phishmg coming at Sony in September— as late as September of this year. We’re still working 

the S&XEXtZSZ into Sony" 0 ° Ur ** *° *" y ° U ' he de ' ai ' S ° n that ' bu ' ,hat seems 

moment they knew they had this problem they reached out to the FBI !nd haTb^n a great 
identity toe perp^ratore' " 9 ‘° UnWlnd undars,and ^ nature and S “P® o' attack, and 

So there is no doubt that imposing costs, both laying hands on people and calling out bad 
conduct, has to be part of the FBI strategy, and it will be. 

need t0 gat better at helping our state and local partners deal with the threat 

x th ^ S ® a ma n ne .r of cnmes that we don’t have the resources and time to get to are appearing 
for the county sheriffs, the local police departments, the local DAs. 

ilLTl !? 8 afe fu aying ’ 1 was ri P ped off ' Somebod y sent me an e-mail saying the FBI director 
needs me to wire this money to Nigeria and I wired it. And so I need help.” 

I don t want anyone within the sound of my voice— I never want you to wire money to me 
anywhere on the earth. ' 
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W®"®f d ? T' P ° Ur State a " d l0cal partners t0 be able t0 be di 9' tal| y iterate and to conduct 
their investigations in responding to the same threats coming through the vector that is cyber 

r? nnn 23 3, ,3 We ’ r ? trying to do is work with the Secret Service to offer training to the 

® and '° cal law enforcement organizations in this country to equip their people to be 
digitally literate. A ton of work going on there. Lots more needs to be done. 


And then last, the fifth part of the strategy is the importance of increasing our cooperation and 
improving our cooperation with our private partners. Let me say why this matters so much. I 
think you get this. All of it is in your world, private sector partners. Invariably, that’s where the 
victims are. That s where the information is that we need in order to be able to respond to 
actions by nation states, by terrorists, by hacktivists, by all — the entire layer cake manifests itself 
on your networks and on your systems. If we can’t find a way to effectively share that 
information to those of us with the enforcement powers, we’re sunk. 


You also see things. You have tremendous brains in the private sector. You see things. You 
think of things that could be tremendously useful to us. We have to find ways, productive ways 
to get the content of your brain into the government. 


Wrthout effective sharing, I’m a bit like a police officer patrolling a street with 50-foot high walls. 

Solid walls on either side of the street. I can tell you the street looks fine. The little piece of the 

world that can see clearly, it looks clean to me. If I can’t see through that 50-foot wall into that 

naghborhood, I have no ability to help make it safe or to even tell you what’s going on there. 

We have to find a way to make those walls in some fashion at least semi-permeable so we can 
share information. 


This is not easy. I know some of the frustration on the private sector side. As I have said I was 
the general counsel of two companies before coming back to government, and I’ve been in lots 

^A/u°? VerS fu° n that went like this ' Why doesnt the government tell us something'?” Right? 
What are they going to do with what we tell them? What if it leaks? What if it gets used aqainst 

us in a competition? What if we get accused of lying to somebody? What if we get sued? What 

are our shareholders going to think? What’s the board going to think? Why can’t the government 
tell us things that we can actually do something about?” 

I understand some of the challenges that lay there right now. I think we need clearer rules for 
the private sector... to offer clear rules of the road for what will happen to what you share and 
what we need you to share. Right? We need better technology. Be able to share information 

information m0re effectlVely and more quickly - You need Protection. You need guidance. I need 


We have made significant progress in a lot of the different parts of the American economy in 
sharing, but there are a bunch of impediments that remain. Mechanical, I mentioned. Leqal I 
mentioned. And then there’s one that’s harder to describe, but feels very real to me, and that is 
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In the wake of Mr. Snowden’s so-called revelations, there’s a wind blowing that I worry has 
blown what is a healthy skepticism of government power— I think everybody should be skeptical 

behind 6 ^? FI t0 a . c j' nic ! sm that P eo P |e don,t wan * to be with us anymore. Meet us out 
behind the 7-Eleven late at night and I'll talk to you as long as nobody sees me Or wear a baa 

he h d H°f 3 m ? et ' ng Wlth the government. Because there is this wind blowing that there^s 
thPr^ h |hat bad '1 w U - re ouching the United States Government. We have to build even though 

ustna n . h r i,lI / h nd: t We V l 9 t0 d ° ° Ur best t0 speak into that wind to tr V to explain how we’re 

M 6 9 °« ernment - But we simp| y cannot tight this threat without talking to 
each other. Without building effective bridges despite the wind that’s blowing. 

So that’s our strategy. Focus ourselves, shrink the world, impose real costs, get better at 

cooperating with our state and local partners and maybe most of all, get better at cooperating 
with our private sector partners. M dl,ng 

Before I leave you though I want to mention something that I know Cy Vance mentioned todav 
because he s been a leader on this— the problem of what we call Going Dark. 

drifNrin 5T T’nif 7 imp ° rtant ta us in law enforcement. Especially in law enforcement. We are 
should drift to “Jut dfeSon Sen0US PUb “° diSCU$Si ° n ** 1 d0n '' ,hink a dem ° CTac * 

When I left government in 2005, there was a significant Going Dark problem with data in motion 
Wo were increasingly finding ourselves in a place where we went to a judge, Te goTa court 

coutdnl 6 Sh0W6d probable cause - we had permission to intercept data in motion and we 

hl^ a |Iinn°SilTt| WaS f kind t bNnk ' ng 0ff t0 my P er 'P her y in 2005. When I came back in 2013, it’s 

h ndldf LnH h in J 01 ? , me because ° f the P rolife r a tion of communication modes, right? The 
dreds and hundreds of apps through which people communicate. We’re making it 

dlfflcult for us w,th la wful authority, especially in our criminal work, to be able to 

wkh court appro val unicatl0ns of drug dea 'ers, organized criminals, of bad people of all sorts 

TTJ an ° ther dimer| sion to it that made it blink even more brightly— directly in front of me. 

i« citK St the da . ta motl ? n ' 'ncreasingly what we’re finding ourselves up against is data at rest that 
is sitting in a place or in a device that, even with a search warrant, we can’t get access to And 
this is everywhere in law enforcement. 9 

There used to be a day in the good old days of jaw enforcement, you get a search warrant vou 

cnmnn^n i° catl0n and tbe knuckleheads would have written down in one of those black’ V 
mposition books who got what and how many kilos there were and you take the book and vou 
would photocopy it and give it to the prosecutor and you would be good to go Now we 

dSLI ?T b d T' a . PDA ' a laptop ' a -and increasingly we^encount^ng 
devices that we cannot get access to even with lawful authority. To me, this is not about the 

government wanting to whack people’s privacy. I’m a big fan of privacy. I don’t want the 

government, without lawful authority, going through anything of mine. 
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This, is about us drifting to a place where there will be zones beyond the reach of the 

law m the United States. The Fourth Amendment is one of the most implant pLTofthil entire 
democracy because the government may not search and seize the people's papers and effects 

^=nd a SA U ' n ° W r' re d * in9 ,0 a place ,hat ' a warram, Srtl be 

pap ® * and ,® ffect f - ev u en w |th c °urt authority, that are beyond the reach of the law Maybe we 
want to go there. Maybe that’s where we want to end up as a democracy. Maybe people decide 

that pnvacy is that important. But I don’t think we’re talking about it enough I don’t think we’re 
thinking about, “So what are the trade-offs involved there?” 

My job, I don t believe, is to tell people what to do. I mean, in a democracy the people should 

he^and h V j ? b t ’h t J link ’ iS simply to say there are significant public safety P implications 

S^i^^ t before W6 J get t0 the p,ace that Cy Vance talks ab °ut- Where people 

vou JnW twJmSi h h 6ir and say ' what d0 you mean you can ’ t? What d0 you mean 

textina Jith T Sr« h ir n haS d ' Sappea [f d ' What d0 you mean y° u can>t tel1 me who she was 
^*' ng ,™ th bef ° re she disappeared? You’ve got the phone. You’ve got a court order ” Before 

we get to what do you mean you can’t,” I think we’ve got to talk about it as a people.' 

that v^n^th'r I' tha f nk y ° U for ^t ing here - Just that you’re attending this conference is a sign 
at you get the significance and the challenge we face that cyber has truly changed evervthina 

responsib ' e for - Thank you especially to those of you in the private sector for making us 9 

akln«ra| f0 f pushing us ; f ° r askin 9 hard questions. I meant it when I said people should be 
skeptical of government. Ask hard questions. We will learn from your questions. 

most of y aii thankf lf19 f US J?** ^ guys that are tryin 9 to do so much harm to you. And 

? A? ’ hank you for the work that 1 think we will do together in a lawful appropriate wav to 
protect the American people. Thanks for listening appropriate way to 


### 
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